fix: resolve OAuth compatibility issues for login-flow deployment

- Drop OIDC fork: comment out third_party/oidc mount, use upstream
  v1.16.3 from app store (fixes consent redirect race, PR #631)
- Support client_secret_basic auth: add _extract_basic_auth() helper
  so TS MCP SDK can authenticate at token endpoint (RFC 6749 §2.3.1)
- Multi-issuer JWT validation: accept tokens with internal Docker
  issuer (http://app:80) or public URL (NEXTCLOUD_PUBLIC_ISSUER_URL)
  since AS proxy obtains tokens server-to-server
- Introspection fallback: try token introspection when JWT verification
  fails, supporting both JWT and opaque token types
- Register all tool scopes in DCR: add semantic:read, collectives:read,
  collectives:write to OIDC client allowed_scopes so tokens include
  them and semantic search tools are visible to authenticated clients
- Auto-create Astrolabe OAuth client: new app-hook creates OIDC client
  and stores credentials in config.php so the "Authorize via OAuth"
  button works without manual setup

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/app.py

@@ -456,12 +456,24 @@ async def load_oauth_client_credentials(
         # and the authorization server will limit them to these allowed scopes.
         #
         # The PRM endpoint advertises the same scopes dynamically via @require_scopes decorators.
-        dcr_scopes = "openid profile email notes:read notes:write calendar:read calendar:write todo:read todo:write contacts:read contacts:write cookbook:read cookbook:write deck:read deck:write tables:read tables:write files:read files:write sharing:read sharing:write news:read news:write"
+        # These must stay in sync — any scope a tool uses via @require_scopes must be listed here.
+        dcr_scopes = (
+            "openid profile email "
+            "notes:read notes:write calendar:read calendar:write todo:read todo:write "
+            "contacts:read contacts:write cookbook:read cookbook:write deck:read deck:write "
+            "tables:read tables:write files:read files:write sharing:read sharing:write "
+            "news:read news:write collectives:read collectives:write"
+        )
 
-        # Add offline_access scope if refresh tokens are enabled
-        # Use settings.enable_offline_access which handles both ENABLE_BACKGROUND_OPERATIONS (new)
-        # and ENABLE_OFFLINE_ACCESS (deprecated) environment variables
+        # Add conditional scopes based on server configuration
         dcr_settings = get_settings()
+
+        # semantic:read gates MCP-server-level semantic search tools
+        if dcr_settings.vector_sync_enabled:
+            dcr_scopes = f"{dcr_scopes} semantic:read"
+            logger.info("✓ semantic:read scope enabled for semantic search tools")
+
+        # offline_access enables refresh tokens for background operations
         enable_offline_access = dcr_settings.enable_offline_access
         if enable_offline_access:
             dcr_scopes = f"{dcr_scopes} offline_access"